October 28, 2000
Hackers Break Into Microsoft Network,
Tap Secrets
By Scott Hillis published by Yahoo News
SEATTLE (Reuters) - Hackers broke into Microsoft
Corp.’s computer network and tapped some of the software giant's
secrets, the company says, revealing one of the boldest industrial spy
capers of the computer age.
The attacks on the world’s biggest software company
also appeared to mark the rise of a new style of hacking that uses a
stealthy program called a worm to slip past computer defenses, security
experts said.
Microsoft said Friday that it discovered the break-ins
within the past several days, but not before some software source code,
which is the basic and secret blueprint for its programs, was exposed.
“It is clear that hackers did see some of our source
code,” Microsoft Chief Executive Steve Ballmer said at a seminar in
Stockholm on Friday. “I can assure you that we know that there has been
no compromise of the integrity of the source code, that it has not been
modified or tampered with in any way.”
Redmond, Wash.-based Microsoft tightly guards the source
code to its products, such as its prized Windows operating system and
Office package of business software.
Microsoft declined to say if the code was stolen, only
that it had been “viewed.” But
security experts said any code that could be read could be stolen.
“If you can view a file, then generally, one way or
another, you can copy it,” said Simon Perry, vice president of security
solutions at Computer Associates International Inc.
Investors were unfazed by the attacks, sending Microsoft
shares up $3-1/4, or 5 percent, to $67-11/16 on the Nasdaq.
Source Code Seen
There was no evidence that the hackers had viewed the
code to current products such as Windows Me for home users, Windows 2000
for businesses, or Office, Microsoft spokesman Rick Miller said.
But, Miller added, “It appeared the hacker was able to
view the source code to a product under development. But the important
thing is that it was not modified or corrupted.”
Miller declined to reveal what exactly had been
targeted, but major products being developed include the next generation
of Windows, code-named Whistler, and an update to Office. Both products
are key steps in Microsoft’s .NET strategy, a sweeping plan to build the
Internet into all its software.
It was highly unlikely a hacker could have seen a
product's entire source code because it would be spread out over several
teams and not compiled in one place, Microsoft said.
“The investigation will focus on which components the
hacker has gained access to, and of what importance that is to the
Microsoft organization,” Perry said. “There is no way the hacker could
access the whole crown jewels, but they could have got access to some of
the gems that make up that crown.”
Miller declined to confirm reports that security
personnel had discovered the break-ins after detecting passwords being
sent to an e-mail account in Russia, a known haven for hackers who have
been fingered for stealing millions of dollars from bank networks, among
other exploits.
Microsoft had notified the Federal Bureau of
Investigation to try to uncover the origin and motive of the attacks. The
FBI said its Seattle office had opened an investigation along with the
National Infrastructure Protection Center at the bureau's headquarters.
Ironically, the FBI is a subdivision of the Justice
Department, which is involved in a major antitrust battle with Microsoft,
and has sought to force the company to publish parts of its Windows source
code.
Heading into the weekend, Miller gave few details about
the probe, saying only, “There is nothing new other than that the
investigation is ongoing.”
Security Concerns
Word of the break-in comes amid growing concern about
computer espionage and security.
Many incidents are believed to go unreported by
companies and government agencies due to the difficulty in tracking the
culprits and the embarrassment of admitting vulnerability.
The highest profile case of source code theft took place
in June 1989, when a group calling itself the “nuPrometheus League”
sent parts of the source code for Apple Computer's Macintosh operating
system to the media and programmers.
As the world's top software company, Microsoft is no
stranger to attempts to crack its network or expose security flaws in its
products.
The “Love Bug” virus that infected millions of
computers around the world in May exploited a vulnerability in a Microsoft
e-mail program, for example.
“There are regular attempts at unauthorized entry into
our network all the time,” Miller said.
Worms Are New Hacker Tools
Microsoft declined to give details about how the attacks
were carried out, but computer security experts said they believed the
hackers used a variant of a known worm called QAZ, which first surfaced in
China several months ago.
A worm is a common type of computer virus that makes
copies of itself to send to other machines. Once it has infected a machine
it can perform tasks like destroying data, transmitting
files, or letting a hacker enter the computer.
“We've been forecasting worm-based industrial
espionage to happen for quite some time and it looks like now it has
happened big time,” said Mikko Hypponen, a security expert at Finland's
F-Secure, a computer security firm.
The worm was believed to have entered Microsoft's
headquarters on the back of another document. Once inside the network, it
would have copied itself and infected other computers, allowing easy
access to files on those machines.
“We've
seen a switch from the standard hacker trying to get through a firewall to
hackers using these tools,” said Vince Gullotto, senior director of
McAfee AVERT Labs. “This is maybe the pinnacle of this kind of attack to
date.” |
